@stigmer/cli 3.12.9 → 3.14.0-dev.20260910084630

package/resources/connect/connect.js

@@ -11,8 +11,8 @@
 // pipes) we stop with actionable guidance instead of blocking for 5 minutes.
 // Audit identity (reviewer) and token acquisition stay server-side by design.
 import { create } from "@bufbuild/protobuf";
-import { ConnectInputSchema, GetOAuthGrantStatusInputSchema } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/io_pb";
-import { connectAndWait, ConnectStillRunningError, CONNECT_SETTLE_BOUND_MS } from "@stigmer/sdk";
+import { ConnectInputSchema, GetOAuthGrantStatusInputSchema, } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/io_pb";
+import { connectAndWait, ConnectStillRunningError, CONNECT_SETTLE_BOUND_MS, } from "@stigmer/sdk";
 import { CliExitError, ExitCode, UsageError } from "../../errors/index.js";
 import { defaultRegistry } from "../../registry/index.js";
 import { PlaceholderResolutionError } from "../mcp/placeholder-resolver.js";
@@ -100,7 +100,10 @@ async function resolveMcpServer(client, reference, org) {
     const parsed = parseReference(reference, org, idPrefix);
     if (parsed.kind === "id")
         return client.mcpServer.get(parsed.id);
-    return client.mcpServer.getByReference({ org: parsed.org, slug: parsed.slug });
+    return client.mcpServer.getByReference({
+        org: parsed.org,
+        slug: parsed.slug,
+    });
 }
 // Ensure an OAuth grant exists before connecting an auth-configured server that
 // was given no --env credentials. On an interactive terminal, run the browser
@@ -128,14 +131,23 @@ async function ensureOAuthSatisfied(client, server, opts) {
     if (!opts.interactive)
         throw oauthGuidanceError(server, opts.reference, oauthOnly);
     const { runOAuthFlow } = await import("./oauth.js");
-    await runOAuthFlow({ client, server, org: opts.org, backendType: opts.backendType });
+    await runOAuthFlow({
+        client,
+        server,
+        org: opts.org,
+        consoleURL: opts.consoleURL,
+        probeLocalConsole: opts.probeLocalConsole,
+    });
 }
 // Turn a strict-resolution failure into actionable guidance. A declared-but-unset
 // variable is the user's to provide; an undeclared one is a bug in the server
 // definition. Both are far clearer than the cryptic subprocess crash (ENOENT on a
 // literal "${VAR}" path) that motivated issue #141.
 function unresolvedEnvError(server, err) {
-    const slug = server.metadata?.slug ?? server.metadata?.name ?? server.metadata?.id ?? "this server";
+    const slug = server.metadata?.slug ??
+        server.metadata?.name ??
+        server.metadata?.id ??
+        "this server";
     const decl = server.spec?.env?.[err.variableName];
     if (decl) {
         const hint = decl.description !== "" ? ` (${decl.description})` : "";

package/resources/connect/connect.js.map

@@ -1 +1 @@
-{"version":3,"file":"connect.js","sourceRoot":"","sources":["../../../src/resources/connect/connect.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,8EAA8E;AAC9E,uEAAuE;AACvE,6EAA6E;AAC7E,yEAAyE;AACzE,cAAc;AACd,EAAE;AACF,+EAA+E;AAC/E,+EAA+E;AAC/E,4EAA4E;AAC5E,6EAA6E;AAC7E,8EAA8E;AAE9E,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAG5C,OAAO,EAAE,kBAAkB,EAAE,8BAA8B,EAAE,MAAM,uDAAuD,CAAC;AAI3H,OAAO,EAAE,cAAc,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAEjG,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,0BAA0B,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAqC9C,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAe,EAAE,IAAoB;IAC1E,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAExE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;YAAE,MAAM,IAAI,UAAU,CAAC,sDAAsD,CAAC,CAAC;QAC5G,6EAA6E;QAC7E,8EAA8E;QAC9E,gFAAgF;QAChF,IAAI,WAAW,CAAC,MAAM,CAAC;YAAE,MAAM,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5E,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YACzF,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QACtD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,qEAAqE;YACrE,uEAAuE;YACvE,iEAAiE;YACjE,IAAI,GAAG,YAAY,0BAA0B;gBAAE,MAAM,kBAAkB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YACrF,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,MAAM,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAEjD,MAAM,KAAK,GAAG,MAAM,CAAC,kBAAkB,EAAE;QACvC,WAAW,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;QACtC,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,UAAU,EAAE,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC;KACvD,CAAC,CAAC;IACH,OAAO,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;AACxD,CAAC;AAED,2EAA2E;AAC3E,uEAAuE;AACvE,6EAA6E;AAC7E,0EAA0E;AAC1E,oCAAoC;AACpC,KAAK,UAAU,iBAAiB,CAC9B,MAAe,EACf,MAAiB,EACjB,KAAmB,EACnB,IAAoB;IAEpB,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,IAAI,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,YAAY,CAAC;IAC1E,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE;YAC5D,UAAU,EAAE,IAAI,CAAC,aAAa;YAC9B,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE;gBACrB,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,IAAI,EAAE,CAAC;YACzD,CAAC;SACF,CAAC,CAAC;QACH,OAAO;YACL,MAAM;YACN,YAAY,EAAE,OAAO,CAAC,MAAM,EAAE,sBAAsB;YACpD,OAAO;YACP,OAAO,EAAE,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;SAC9C,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,CAAC,GAAG,YAAY,wBAAwB,CAAC;YAAE,MAAM,GAAG,CAAC;QAC1D,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACrC,wEAAwE;YACxE,MAAM,IAAI,YAAY,CACpB,kDAAkD,IAAI,WAAW,IAAI,CAAC,aAAa,GAAG,IAAI,eAAe,EACzG,QAAQ,CAAC,UAAU,EACnB;gBACE,sFAAsF;gBACtF,kDAAkD,IAAI,EAAE;gBACxD,kDAAkD;aACnD,CACF,CAAC;QACJ,CAAC;QACD,uEAAuE;QACvE,0EAA0E;QAC1E,MAAM,IAAI,YAAY,CACpB,8BAA8B,IAAI,2BAA2B,uBAAuB,GAAG,MAAM,UAAU,EACvG,QAAQ,CAAC,UAAU,EACnB;YACE,yDAAyD;YACzD,wDAAwD,IAAI,EAAE;YAC9D,gDAAgD;SACjD,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,kBAAkB;AAClB,KAAK,UAAU,gBAAgB,CAAC,MAAe,EAAE,SAAiB,EAAE,GAAW;IAC7E,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,QAAQ,IAAI,EAAE,CAAC;IAC5E,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IACxD,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACjE,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,gFAAgF;AAChF,8EAA8E;AAC9E,0EAA0E;AAC1E,4EAA4E;AAC5E,KAAK,UAAU,oBAAoB,CAAC,MAAe,EAAE,MAAiB,EAAE,IAAoB;IAC1F,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;QAAE,OAAO;IAEnC,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAEtC,8EAA8E;IAC9E,+EAA+E;IAC/E,+EAA+E;IAC/E,kCAAkC;IAClC,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,IAAI,CAAC,SAAS;YAAE,OAAO;QACvB,MAAM,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,mBAAmB,CACvD,MAAM,CAAC,8BAA8B,EAAE;QACrC,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;QACrC,GAAG,EAAE,IAAI,CAAC,GAAG;KACd,CAAC,CACH,CAAC;IACF,IAAI,MAAM,CAAC,SAAS;QAAE,OAAO;IAE7B,IAAI,CAAC,IAAI,CAAC,WAAW;QAAE,MAAM,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAEnF,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;IACpD,MAAM,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;AACvF,CAAC;AAED,kFAAkF;AAClF,8EAA8E;AAC9E,kFAAkF;AAClF,oDAAoD;AACpD,SAAS,kBAAkB,CAAC,MAAiB,EAAE,GAA+B;IAC5E,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,IAAI,IAAI,MAAM,CAAC,QAAQ,EAAE,IAAI,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,aAAa,CAAC;IACpG,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAClD,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,OAAO,IAAI,UAAU,CACnB,eAAe,IAAI,gCAAgC,GAAG,CAAC,YAAY,GAAG,IAAI,wBAAwB;YAChG,yBAAyB,GAAG,CAAC,YAAY,+DAA+D,CAC3G,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,OAAO,IAAI,UAAU,CACnB,eAAe,IAAI,mBAAmB,GAAG,CAAC,YAAY,IAAI,KAAK,yBAAyB,GAAG,CAAC,YAAY,oBAAoB;QAC1H,0DAA0D,GAAG,CAAC,YAAY,kDAAkD,CAC/H,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAiB,EAAE,SAAiB,EAAE,SAAkB;IAClF,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,IAAI,IAAI,MAAM,CAAC,QAAQ,EAAE,IAAI,IAAI,SAAS,CAAC;IACzE,MAAM,OAAO,GAAG;QACd,sFAAsF;KACvF,CAAC;IACF,0EAA0E;IAC1E,gFAAgF;IAChF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,gEAAgE,IAAI,kBAAkB,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,IAAI,UAAU,CACnB,eAAe,IAAI,2EAA2E;QAC5F,aAAa,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,KAAK;QACpD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CACrB,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,6EAA6E;AAC7E,0DAA0D;AAC1D,SAAS,iBAAiB,CAAC,MAAiB,EAAE,SAAiB;IAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,IAAI,IAAI,MAAM,CAAC,QAAQ,EAAE,IAAI,IAAI,SAAS,CAAC;IACzE,OAAO,IAAI,UAAU,CACnB,eAAe,IAAI,qFAAqF;QACtG,0FAA0F,IAAI,EAAE,CACnG,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,8EAA8E;AAC9E,gFAAgF;AAChF,SAAS,oBAAoB,CAAC,MAAiB,EAAE,SAAiB;IAChE,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,IAAI,IAAI,MAAM,CAAC,QAAQ,EAAE,IAAI,IAAI,SAAS,CAAC;IACzE,OAAO,IAAI,UAAU,CACnB,eAAe,IAAI,oJAAoJ;QACrK,yEAAyE,IAAI,EAAE,CAClF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,MAAiB;IACtC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,YAAY,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,WAAW,CAAC,MAAiB;IACpC,OAAO,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,KAAK,IAAI,CAAC;AAC/C,CAAC"}
+{"version":3,"file":"connect.js","sourceRoot":"","sources":["../../../src/resources/connect/connect.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,8EAA8E;AAC9E,uEAAuE;AACvE,6EAA6E;AAC7E,yEAAyE;AACzE,cAAc;AACd,EAAE;AACF,+EAA+E;AAC/E,+EAA+E;AAC/E,4EAA4E;AAC5E,6EAA6E;AAC7E,8EAA8E;AAE9E,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAG5C,OAAO,EACL,kBAAkB,EAClB,8BAA8B,GAC/B,MAAM,uDAAuD,CAAC;AAI/D,OAAO,EACL,cAAc,EACd,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,0BAA0B,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAuC9C,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAe,EACf,IAAoB;IAEpB,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAExE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;YAC3B,MAAM,IAAI,UAAU,CAClB,sDAAsD,CACvD,CAAC;QACJ,6EAA6E;QAC7E,8EAA8E;QAC9E,gFAAgF;QAChF,IAAI,WAAW,CAAC,MAAM,CAAC;YAAE,MAAM,oBAAoB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5E,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,aAAa,CACtC,MAAM,CAAC,IAAI,EACX,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,SAAS,CACf,CAAC;YACF,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;QACtD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,qEAAqE;YACrE,uEAAuE;YACvE,iEAAiE;YACjE,IAAI,GAAG,YAAY,0BAA0B;gBAC3C,MAAM,kBAAkB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YACxC,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,MAAM,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAEjD,MAAM,KAAK,GAAG,MAAM,CAAC,kBAAkB,EAAE;QACvC,WAAW,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;QACtC,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,UAAU,EAAE,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC;KACvD,CAAC,CAAC;IACH,OAAO,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;AACxD,CAAC;AAED,2EAA2E;AAC3E,uEAAuE;AACvE,6EAA6E;AAC7E,0EAA0E;AAC1E,oCAAoC;AACpC,KAAK,UAAU,iBAAiB,CAC9B,MAAe,EACf,MAAiB,EACjB,KAAmB,EACnB,IAAoB;IAEpB,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,IAAI,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,YAAY,CAAC;IAC1E,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE;YAC5D,UAAU,EAAE,IAAI,CAAC,aAAa;YAC9B,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE;gBACrB,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,IAAI,EAAE,CAAC;YACzD,CAAC;SACF,CAAC,CAAC;QACH,OAAO;YACL,MAAM;YACN,YAAY,EAAE,OAAO,CAAC,MAAM,EAAE,sBAAsB;YACpD,OAAO;YACP,OAAO,EAAE,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;SAC9C,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,CAAC,GAAG,YAAY,wBAAwB,CAAC;YAAE,MAAM,GAAG,CAAC;QAC1D,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACrC,wEAAwE;YACxE,MAAM,IAAI,YAAY,CACpB,kDAAkD,IAAI,WAAW,IAAI,CAAC,aAAa,GAAG,IAAI,eAAe,EACzG,QAAQ,CAAC,UAAU,EACnB;gBACE,sFAAsF;gBACtF,kDAAkD,IAAI,EAAE;gBACxD,kDAAkD;aACnD,CACF,CAAC;QACJ,CAAC;QACD,uEAAuE;QACvE,0EAA0E;QAC1E,MAAM,IAAI,YAAY,CACpB,8BAA8B,IAAI,2BAA2B,uBAAuB,GAAG,MAAM,UAAU,EACvG,QAAQ,CAAC,UAAU,EACnB;YACE,yDAAyD;YACzD,wDAAwD,IAAI,EAAE;YAC9D,gDAAgD;SACjD,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,kBAAkB;AAClB,KAAK,UAAU,gBAAgB,CAC7B,MAAe,EACf,SAAiB,EACjB,GAAW;IAEX,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,QAAQ,IAAI,EAAE,CAAC;IAC5E,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IACxD,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACjE,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC;QACrC,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,IAAI,EAAE,MAAM,CAAC,IAAI;KAClB,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAChF,8EAA8E;AAC9E,0EAA0E;AAC1E,4EAA4E;AAC5E,KAAK,UAAU,oBAAoB,CACjC,MAAe,EACf,MAAiB,EACjB,IAAoB;IAEpB,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;QAAE,OAAO;IAEnC,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAEtC,8EAA8E;IAC9E,+EAA+E;IAC/E,+EAA+E;IAC/E,kCAAkC;IAClC,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,IAAI,CAAC,SAAS;YAAE,OAAO;QACvB,MAAM,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,mBAAmB,CACvD,MAAM,CAAC,8BAA8B,EAAE;QACrC,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE;QACrC,GAAG,EAAE,IAAI,CAAC,GAAG;KACd,CAAC,CACH,CAAC;IACF,IAAI,MAAM,CAAC,SAAS;QAAE,OAAO;IAE7B,IAAI,CAAC,IAAI,CAAC,WAAW;QACnB,MAAM,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAE9D,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;IACpD,MAAM,YAAY,CAAC;QACjB,MAAM;QACN,MAAM;QACN,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;KAC1C,CAAC,CAAC;AACL,CAAC;AAED,kFAAkF;AAClF,8EAA8E;AAC9E,kFAAkF;AAClF,oDAAoD;AACpD,SAAS,kBAAkB,CACzB,MAAiB,EACjB,GAA+B;IAE/B,MAAM,IAAI,GACR,MAAM,CAAC,QAAQ,EAAE,IAAI;QACrB,MAAM,CAAC,QAAQ,EAAE,IAAI;QACrB,MAAM,CAAC,QAAQ,EAAE,EAAE;QACnB,aAAa,CAAC;IAChB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAClD,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,OAAO,IAAI,UAAU,CACnB,eAAe,IAAI,gCAAgC,GAAG,CAAC,YAAY,GAAG,IAAI,wBAAwB;YAChG,yBAAyB,GAAG,CAAC,YAAY,+DAA+D,CAC3G,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,OAAO,IAAI,UAAU,CACnB,eAAe,IAAI,mBAAmB,GAAG,CAAC,YAAY,IAAI,KAAK,yBAAyB,GAAG,CAAC,YAAY,oBAAoB;QAC1H,0DAA0D,GAAG,CAAC,YAAY,kDAAkD,CAC/H,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,MAAiB,EACjB,SAAiB,EACjB,SAAkB;IAElB,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,IAAI,IAAI,MAAM,CAAC,QAAQ,EAAE,IAAI,IAAI,SAAS,CAAC;IACzE,MAAM,OAAO,GAAG;QACd,sFAAsF;KACvF,CAAC;IACF,0EAA0E;IAC1E,gFAAgF;IAChF,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CACV,gEAAgE,IAAI,kBAAkB,CACvF,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,UAAU,CACnB,eAAe,IAAI,2EAA2E;QAC5F,aAAa,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,KAAK;QACpD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CACrB,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,6EAA6E;AAC7E,0DAA0D;AAC1D,SAAS,iBAAiB,CAAC,MAAiB,EAAE,SAAiB;IAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,IAAI,IAAI,MAAM,CAAC,QAAQ,EAAE,IAAI,IAAI,SAAS,CAAC;IACzE,OAAO,IAAI,UAAU,CACnB,eAAe,IAAI,qFAAqF;QACtG,0FAA0F,IAAI,EAAE,CACnG,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,8EAA8E;AAC9E,gFAAgF;AAChF,SAAS,oBAAoB,CAC3B,MAAiB,EACjB,SAAiB;IAEjB,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,IAAI,IAAI,MAAM,CAAC,QAAQ,EAAE,IAAI,IAAI,SAAS,CAAC;IACzE,OAAO,IAAI,UAAU,CACnB,eAAe,IAAI,oJAAoJ;QACrK,yEAAyE,IAAI,EAAE,CAClF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,MAAiB;IACtC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,YAAY,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,WAAW,CAAC,MAAiB;IACpC,OAAO,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,KAAK,IAAI,CAAC;AAC/C,CAAC"}

package/resources/connect/oauth.d.ts

@@ -1,12 +1,15 @@
 import type { McpServer } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
 import type { Stigmer } from "@stigmer/sdk";
-import type { BackendType } from "../../config/config.js";
 /** Injectable side effects + inputs for {@link runOAuthFlow}. */
 export interface OAuthFlowDeps {
     readonly client: Stigmer;
     readonly server: McpServer;
     readonly org: string;
-    readonly backendType: BackendType;
+    /** The web console origin (resolveConsoleURL over the caller's config). */
+    readonly consoleURL: string;
+    /** Probe the console before opening the browser (the local daemon's
+     * console may simply not be running; remote consoles answer or 404). */
+    readonly probeLocalConsole: boolean;
     /** Opens the page URL in the user's browser. Defaults to the OS opener. */
     readonly openBrowser?: (url: string) => Promise<void>;
     /** Probes whether the local web console is reachable. Defaults to a 2s GET. */

package/resources/connect/oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/resources/connect/oauth.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wDAAwD,CAAC;AAExF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAQ1D,iEAAiE;AACjE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,2EAA2E;IAC3E,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,+EAA+E;IAC/E,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1D,oEAAoE;IACpE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,iEAAiE;IACjE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,gFAAgF;IAChF,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACvC;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAyBrE;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAmB1E;AAED,kEAAkE;AAClE,wBAAsB,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAKzG;AAgDD,wEAAwE;AACxE,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,CAAC,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,CAAC,CAWrG"}
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/resources/connect/oauth.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wDAAwD,CAAC;AAExF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAO5C,iEAAiE;AACjE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,2EAA2E;IAC3E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;4EACwE;IACxE,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,2EAA2E;IAC3E,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,+EAA+E;IAC/E,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1D,oEAAoE;IACpE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,iEAAiE;IACjE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,gFAAgF;IAChF,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACvC;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CA4BrE;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAqB1E;AAED,kEAAkE;AAClE,wBAAsB,eAAe,CACnC,MAAM,EAAE,OAAO,EACf,WAAW,EAAE,MAAM,EACnB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,OAAO,CAAC,CAKlB;AAkDD,wEAAwE;AACxE,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,CAAC,QAAQ,EACzB,GAAG,EAAE,MAAM,GACV,CAAC,MAAM,GAAG,SAAS,EAAE,MAAM,EAAE,CAAC,CAWhC"}

package/resources/connect/oauth.js

@@ -12,7 +12,6 @@
 // real browser, network, or wall-clock delay.
 import { create } from "@bufbuild/protobuf";
 import { GetOAuthGrantStatusInputSchema } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/io_pb";
-import { resolveConsoleURL } from "../../config/index.js";
 import { UsageError } from "../../errors/index.js";
 const POLL_INTERVAL_MS = 3000;
 const POLL_TIMEOUT_MS = 5 * 60 * 1000;
@@ -24,8 +23,8 @@ const CONSOLE_PROBE_TIMEOUT_MS = 2000;
  */
 export async function runOAuthFlow(deps) {
     const log = deps.log ?? stderrLog;
-    const consoleURL = resolveConsoleURL(deps.backendType);
-    if (deps.backendType === "local") {
+    const consoleURL = deps.consoleURL;
+    if (deps.probeLocalConsole) {
         const probe = deps.probeConsole ?? probeWebConsole;
         if (!(await probe(consoleURL)))
             throw consoleUnavailableError(deps.server.metadata?.slug ?? "<slug>");
@@ -76,7 +75,9 @@ export async function checkOAuthGrant(client, mcpServerId, org) {
 // an error status) means it's serving; a network/timeout failure means it isn't.
 async function probeWebConsole(url) {
     try {
-        const response = await fetch(url, { signal: AbortSignal.timeout(CONSOLE_PROBE_TIMEOUT_MS) });
+        const response = await fetch(url, {
+            signal: AbortSignal.timeout(CONSOLE_PROBE_TIMEOUT_MS),
+        });
         // Drain the body so the socket can close promptly.
         await response.body?.cancel();
         return true;

package/resources/connect/oauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../src/resources/connect/oauth.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,gFAAgF;AAChF,6EAA6E;AAC7E,gFAAgF;AAChF,8BAA8B;AAC9B,EAAE;AACF,gFAAgF;AAChF,iFAAiF;AACjF,EAAE;AACF,6EAA6E;AAC7E,6EAA6E;AAC7E,8CAA8C;AAE9C,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EAAE,8BAA8B,EAAE,MAAM,uDAAuD,CAAC;AAGvG,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAEnD,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAC9B,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACtC,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAoBtC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAmB;IACpD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,SAAS,CAAC;IAClC,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAEvD,IAAI,IAAI,CAAC,WAAW,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,IAAI,eAAe,CAAC;QACnD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,UAAU,CAAC,CAAC;YAAE,MAAM,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,IAAI,QAAQ,CAAC,CAAC;IACxG,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC;IAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,IAAI,IAAI,CAAC;IAChD,MAAM,OAAO,GAAG,GAAG,UAAU,IAAI,IAAI,CAAC,GAAG,gBAAgB,IAAI,EAAE,CAAC;IAEhE,GAAG,CAAC,sCAAsC,IAAI,IAAI,CAAC,CAAC;IACpD,GAAG,CAAC,mDAAmD,CAAC,CAAC;IACzD,GAAG,CAAC,4DAA4D,OAAO,IAAI,CAAC,CAAC;IAE7E,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,IAAI,aAAa,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,CAAC,oFAAoF,CAAC,CAAC;IAC5F,CAAC;IAED,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAmB;IACzD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,SAAS,CAAC;IAClC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC;IACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;IAChD,MAAM,QAAQ,GAAG,GAAG,EAAE,GAAG,eAAe,CAAC;IAEzC,GAAG,CAAC,0DAA0D,CAAC,CAAC;IAEhE,SAAS,CAAC;QACR,MAAM,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC9B,IAAI,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,UAAU,CAAC,2DAA2D,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,MAAM,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,iCAAiC,CAAC,CAAC;YACvC,OAAO;QACT,CAAC;IACH,CAAC;AACH,CAAC;AAED,kEAAkE;AAClE,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAe,EAAE,WAAmB,EAAE,GAAW;IACrF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,mBAAmB,CACvD,MAAM,CAAC,8BAA8B,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CACzE,CAAC;IACF,OAAO,MAAM,CAAC,SAAS,CAAC;AAC1B,CAAC;AAED,gFAAgF;AAChF,iFAAiF;AACjF,KAAK,UAAU,eAAe,CAAC,GAAW;IACxC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC;QAC7F,mDAAmD;QACnD,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,iFAAiF;AACjF,8EAA8E;AAC9E,4EAA4E;AAC5E,SAAS,uBAAuB,CAAC,IAAY;IAC3C,OAAO,IAAI,UAAU,CACnB,gFAAgF;QAC9E,uCAAuC;QACvC,gEAAgE,IAAI,oBAAoB;QACxF,6EAA6E,CAChF,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,gFAAgF;AAChF,wDAAwD;AACxD,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;YACrD,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YAC9D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,KAAK,CAAC,yBAAyB,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;gBAC/D,OAAO;YACT,CAAC;YACD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YACxE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,cAAc,CAAC,QAAyB,EAAE,GAAW;IACnE,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACzB,KAAK,OAAO;YACV,OAAO,CAAC,UAAU,EAAE,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC,CAAC;QAC5D,KAAK,OAAO;YACV,OAAO,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B;YACE,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,EAAU;IAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;AACpC,CAAC"}
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../src/resources/connect/oauth.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,gFAAgF;AAChF,6EAA6E;AAC7E,gFAAgF;AAChF,8BAA8B;AAC9B,EAAE;AACF,gFAAgF;AAChF,iFAAiF;AACjF,EAAE;AACF,6EAA6E;AAC7E,6EAA6E;AAC7E,8CAA8C;AAE9C,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EAAE,8BAA8B,EAAE,MAAM,uDAAuD,CAAC;AAEvG,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAEnD,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAC9B,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACtC,MAAM,wBAAwB,GAAG,IAAI,CAAC;AAwBtC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAmB;IACpD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,SAAS,CAAC;IAClC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IAEnC,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,IAAI,eAAe,CAAC;QACnD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,UAAU,CAAC,CAAC;YAC5B,MAAM,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,IAAI,QAAQ,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC;IAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,IAAI,IAAI,CAAC;IAChD,MAAM,OAAO,GAAG,GAAG,UAAU,IAAI,IAAI,CAAC,GAAG,gBAAgB,IAAI,EAAE,CAAC;IAEhE,GAAG,CAAC,sCAAsC,IAAI,IAAI,CAAC,CAAC;IACpD,GAAG,CAAC,mDAAmD,CAAC,CAAC;IACzD,GAAG,CAAC,4DAA4D,OAAO,IAAI,CAAC,CAAC;IAE7E,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,IAAI,aAAa,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,GAAG,CACD,oFAAoF,CACrF,CAAC;IACJ,CAAC;IAED,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAmB;IACzD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,SAAS,CAAC;IAClC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC;IACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;IAChD,MAAM,QAAQ,GAAG,GAAG,EAAE,GAAG,eAAe,CAAC;IAEzC,GAAG,CAAC,0DAA0D,CAAC,CAAC;IAEhE,SAAS,CAAC;QACR,MAAM,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC9B,IAAI,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,UAAU,CAClB,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,iCAAiC,CAAC,CAAC;YACvC,OAAO;QACT,CAAC;IACH,CAAC;AACH,CAAC;AAED,kEAAkE;AAClE,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAe,EACf,WAAmB,EACnB,GAAW;IAEX,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,mBAAmB,CACvD,MAAM,CAAC,8BAA8B,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CACzE,CAAC;IACF,OAAO,MAAM,CAAC,SAAS,CAAC;AAC1B,CAAC;AAED,gFAAgF;AAChF,iFAAiF;AACjF,KAAK,UAAU,eAAe,CAAC,GAAW;IACxC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,wBAAwB,CAAC;SACtD,CAAC,CAAC;QACH,mDAAmD;QACnD,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,iFAAiF;AACjF,8EAA8E;AAC9E,4EAA4E;AAC5E,SAAS,uBAAuB,CAAC,IAAY;IAC3C,OAAO,IAAI,UAAU,CACnB,gFAAgF;QAC9E,uCAAuC;QACvC,gEAAgE,IAAI,oBAAoB;QACxF,6EAA6E,CAChF,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,gFAAgF;AAChF,wDAAwD;AACxD,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;YACrD,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YAC9D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,KAAK,CAAC,yBAAyB,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;gBAC/D,OAAO;YACT,CAAC;YACD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YACxE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,cAAc,CAC5B,QAAyB,EACzB,GAAW;IAEX,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACzB,KAAK,OAAO;YACV,OAAO,CAAC,UAAU,EAAE,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC,CAAC;QAC5D,KAAK,OAAO;YACV,OAAO,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B;YACE,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,EAAU;IAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;AACpC,CAAC"}

package/src/auth/login.ts

@@ -10,7 +10,12 @@
 // Progress goes to stderr; the command layer renders the final result.
 
 import open from "open";
-import { load, save } from "../config/index.js";
+import {
+  CLOUD_BACKEND_NAME,
+  activeBackend,
+  load,
+  save,
+} from "../config/index.js";
 import { CliExitError, ExitCode } from "../errors/index.js";
 import { log } from "../logger.js";
 import { buildAuthorizeUrl, CALLBACK_PATH, CALLBACK_PORT } from "./auth0.js";
@@ -21,6 +26,27 @@ import { exchangeCode } from "./token.js";
 const LOGIN_TIMEOUT_MS = 5 * 60 * 1000;
 
 export async function login(): Promise<void> {
+  // Browser PKCE targets Stigmer Cloud only: the Auth0 coordinates are
+  // compiled in. From the local backend, login lands on (creating if
+  // needed) the reserved "cloud" entry — today's behavior in the named
+  // model. On a selfhost backend the flow refuses with the self-host
+  // credential story (API tokens) instead of silently writing cloud
+  // credentials the active backend would never send.
+  const preflight = load();
+  const { name, entry } = activeBackend(preflight);
+  if (entry?.type === "selfhost") {
+    throw new CliExitError(
+      `backend "${name}" is self-hosted — browser login targets Stigmer Cloud only`,
+      ExitCode.Usage,
+      [
+        "Authenticate a self-hosted backend with an API token:",
+        "  stigmer apikey create --name cli",
+        `  stigmer config backend add ${name} --endpoint <host:port> --api-key <key>`,
+        "or switch first:  stigmer config backend use cloud",
+      ],
+    );
+  }
+
   const verifier = generateVerifier();
   const codeChallenge = challengeS256(verifier);
   const state = generateState();
@@ -30,30 +56,49 @@ export async function login(): Promise<void> {
   try {
     const authUrl = buildAuthorizeUrl({ state, codeChallenge });
     process.stderr.write("Opening browser for authentication...\n");
-    process.stderr.write(`If the browser doesn't open automatically, visit:\n${authUrl}\n\n`);
+    process.stderr.write(
+      `If the browser doesn't open automatically, visit:\n${authUrl}\n\n`,
+    );
 
     try {
       await open(authUrl);
     } catch (err) {
-      log.debug(`failed to open browser automatically: ${(err as Error).message}`);
-      process.stderr.write("Could not open the browser automatically. Please open the URL above.\n");
+      log.debug(
+        `failed to open browser automatically: ${(err as Error).message}`,
+      );
+      process.stderr.write(
+        "Could not open the browser automatically. Please open the URL above.\n",
+      );
     }
 
     const callback = await server.waitForCallback(LOGIN_TIMEOUT_MS);
     if (callback.state !== state) {
-      throw new CliExitError("OAuth state mismatch — possible CSRF attack, aborting login", ExitCode.Auth);
+      throw new CliExitError(
+        "OAuth state mismatch — possible CSRF attack, aborting login",
+        ExitCode.Auth,
+      );
     }
 
-    const tokens = await exchangeCode({ code: callback.code, codeVerifier: verifier });
+    const tokens = await exchangeCode({
+      code: callback.code,
+      codeVerifier: verifier,
+    });
 
     const config = load();
-    config.backend.type = "cloud";
-    config.backend.cloud = {
-      ...config.backend.cloud,
+    const active = activeBackend(config);
+    // A cloud-type backend keeps its own login; anything else (the local
+    // daemon) lands on the reserved "cloud" entry and switches to it.
+    const targetName =
+      active.entry?.type === "cloud" ? active.name : CLOUD_BACKEND_NAME;
+    const backends = (config.backends ??= {});
+    backends[targetName] = {
+      ...(backends[targetName] ?? { type: "cloud" }),
+      type: "cloud",
       token: tokens.accessToken,
       refresh_token: tokens.refreshToken,
       token_expiry: tokens.expiresAt,
     };
+    config.current_backend = targetName;
     save(config);
   } finally {
     await server.shutdown();

package/src/auth/token.test.ts

@@ -2,7 +2,7 @@ import { mkdtempSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import type { Config } from "../config/index.js";
+import type { Config, NamedBackendConfig } from "../config/index.js";
 import { createRefreshingTokenProvider } from "./token.js";
 
 // The provider persists refreshed tokens via config.save(), which writes to
@@ -10,11 +10,35 @@ import { createRefreshingTokenProvider } from "./token.js";
 // the developer's real config.
 let originalHome: string | undefined;
 
-function cloudConfig(overrides: Partial<NonNullable<Config["backend"]["cloud"]>>): Config {
-  return { backend: { type: "cloud", cloud: { endpoint: "api.stigmer.ai:443", ...overrides } } };
+function cloudConfig(overrides: Partial<NamedBackendConfig>): Config {
+  return {
+    backend: { type: "cloud" },
+    backends: {
+      cloud: { type: "cloud", endpoint: "api.stigmer.ai:443", ...overrides },
+    },
+    current_backend: "cloud",
+  };
 }
 
-function mockFetch(response: { ok: boolean; status?: number; body: unknown }): void {
+function selfhostConfig(overrides: Partial<NamedBackendConfig> = {}): Config {
+  return {
+    backend: { type: "cloud" },
+    backends: {
+      staging: {
+        type: "selfhost",
+        endpoint: "stigmer.example.com:7234",
+        ...overrides,
+      },
+    },
+    current_backend: "staging",
+  };
+}
+
+function mockFetch(response: {
+  ok: boolean;
+  status?: number;
+  body: unknown;
+}): void {
   vi.stubGlobal(
     "fetch",
     vi.fn(async () => ({
@@ -42,7 +66,9 @@ describe("createRefreshingTokenProvider", () => {
     process.env.STIGMER_API_KEY = "env-key";
     const fetchSpy = vi.fn();
     vi.stubGlobal("fetch", fetchSpy);
-    const provider = createRefreshingTokenProvider(cloudConfig({ token: "stale", token_expiry: past() }));
+    const provider = createRefreshingTokenProvider(
+      cloudConfig({ token: "stale", token_expiry: past() }),
+    );
     expect(await provider()).toBe("env-key");
     expect(fetchSpy).not.toHaveBeenCalled();
   });
@@ -50,24 +76,52 @@ describe("createRefreshingTokenProvider", () => {
   it("returns a non-expired token without refreshing", async () => {
     const fetchSpy = vi.fn();
     vi.stubGlobal("fetch", fetchSpy);
-    const provider = createRefreshingTokenProvider(cloudConfig({ token: "good", token_expiry: future() }));
+    const provider = createRefreshingTokenProvider(
+      cloudConfig({ token: "good", token_expiry: future() }),
+    );
     expect(await provider()).toBe("good");
     expect(fetchSpy).not.toHaveBeenCalled();
   });
 
-  it("refreshes an expired token and persists the new one", async () => {
-    mockFetch({ ok: true, body: { access_token: "fresh", refresh_token: "r2", expires_in: 3600 } });
-    const config = cloudConfig({ token: "expired", token_expiry: past(), refresh_token: "r1" });
+  it("refreshes an expired token and persists the new one into the entry", async () => {
+    mockFetch({
+      ok: true,
+      body: { access_token: "fresh", refresh_token: "r2", expires_in: 3600 },
+    });
+    const config = cloudConfig({
+      token: "expired",
+      token_expiry: past(),
+      refresh_token: "r1",
+    });
     const provider = createRefreshingTokenProvider(config);
     expect(await provider()).toBe("fresh");
-    expect(config.backend.cloud?.token).toBe("fresh");
-    expect(config.backend.cloud?.refresh_token).toBe("r2");
+    expect(config.backends?.["cloud"]?.token).toBe("fresh");
+    expect(config.backends?.["cloud"]?.refresh_token).toBe("r2");
+  });
+
+  it("returns the selfhost entry's api_key without any refresh machinery", async () => {
+    const fetchSpy = vi.fn();
+    vi.stubGlobal("fetch", fetchSpy);
+    const provider = createRefreshingTokenProvider(
+      selfhostConfig({ api_key: "stk_stored" }),
+    );
+    expect(await provider()).toBe("stk_stored");
+    expect(fetchSpy).not.toHaveBeenCalled();
+  });
+
+  it("returns null on a selfhost backend with no stored key", async () => {
+    const provider = createRefreshingTokenProvider(selfhostConfig());
+    expect(await provider()).toBeNull();
   });
 
   it("falls back to the existing token when refresh fails", async () => {
     mockFetch({ ok: false, status: 401, body: { error: "invalid_grant" } });
     const provider = createRefreshingTokenProvider(
-      cloudConfig({ token: "expired", token_expiry: past(), refresh_token: "r1" }),
+      cloudConfig({
+        token: "expired",
+        token_expiry: past(),
+        refresh_token: "r1",
+      }),
     );
     expect(await provider()).toBe("expired");
   });
@@ -80,7 +134,9 @@ describe("createRefreshingTokenProvider", () => {
   it("treats a token without an expiry as valid (legacy)", async () => {
     const fetchSpy = vi.fn();
     vi.stubGlobal("fetch", fetchSpy);
-    const provider = createRefreshingTokenProvider(cloudConfig({ token: "legacy" }));
+    const provider = createRefreshingTokenProvider(
+      cloudConfig({ token: "legacy" }),
+    );
     expect(await provider()).toBe("legacy");
     expect(fetchSpy).not.toHaveBeenCalled();
   });

package/src/auth/token.ts

@@ -2,7 +2,12 @@
 // expired access token, and expose a token provider that refreshes silently.
 
 import type { TokenProvider } from "@stigmer/sdk";
-import { type Config, save } from "../config/index.js";
+import {
+  type Config,
+  type NamedBackendConfig,
+  activeBackend,
+  save,
+} from "../config/index.js";
 import { CliExitError, ExitCode } from "../errors/index.js";
 import { CLIENT_ID, callbackUrl, TOKEN_URL } from "./auth0.js";
 
@@ -28,7 +33,10 @@ interface Auth0TokenResponse {
 }
 
 /** Exchange a PKCE authorization code for an access (+refresh) token. */
-export async function exchangeCode(params: { code: string; codeVerifier: string }): Promise<TokenSet> {
+export async function exchangeCode(params: {
+  code: string;
+  codeVerifier: string;
+}): Promise<TokenSet> {
   return postToken({
     grant_type: "authorization_code",
     client_id: CLIENT_ID,
@@ -39,7 +47,9 @@ export async function exchangeCode(params: { code: string; codeVerifier: string
 }
 
 /** Exchange a refresh token for a fresh access token. */
-export async function refreshAccessToken(refreshToken: string): Promise<TokenSet> {
+export async function refreshAccessToken(
+  refreshToken: string,
+): Promise<TokenSet> {
   return postToken({
     grant_type: "refresh_token",
     client_id: CLIENT_ID,
@@ -50,12 +60,17 @@ export async function refreshAccessToken(refreshToken: string): Promise<TokenSet
 /**
  * A token provider for the backend client that keeps the access token fresh.
  *
- * Precedence and behavior, evaluated per request:
+ * Precedence and behavior, evaluated per request against the ACTIVE named
+ * backend:
  *   1. STIGMER_API_KEY (env / bridged --api-key) wins and is never refreshed.
- *   2. A non-expired access token is returned as-is.
- *   3. An expired token with a refresh token is refreshed; the new token,
- *      rotated refresh token, and expiry are persisted, then returned.
- *   4. Otherwise the (possibly stale) token or null is returned, letting the
+ *   2. selfhost backends return their stored api_key (no refresh machinery —
+ *      server-minted `stk_` tokens are opaque and live until deleted or
+ *      expired server-side); local returns null (no auth).
+ *   3. A cloud backend's non-expired access token is returned as-is.
+ *   4. An expired token with a refresh token is refreshed; the new token,
+ *      rotated refresh token, and expiry are persisted INTO THE ENTRY, then
+ *      returned.
+ *   5. Otherwise the (possibly stale) token or null is returned, letting the
  *      server reject it so the error maps to a clear "please log in" exit.
  *
  * Closes over `config` so a refresh updates the same object the rest of the
@@ -66,30 +81,38 @@ export function createRefreshingTokenProvider(config: Config): TokenProvider {
     const envKey = process.env.STIGMER_API_KEY;
     if (envKey !== undefined && envKey !== "") return envKey;
 
-    const cloud = config.backend.cloud;
-    if (cloud?.token === undefined || cloud.token === "") {
-      return cloud?.refresh_token ? refreshAndPersist(config, cloud.refresh_token) : null;
+    const { entry } = activeBackend(config);
+    if (entry === undefined) return null;
+    if (entry.type === "selfhost") return entry.api_key ?? null;
+
+    if (entry.token === undefined || entry.token === "") {
+      return entry.refresh_token
+        ? refreshAndPersist(config, entry, entry.refresh_token)
+        : null;
     }
-    if (!isExpired(cloud.token_expiry)) return cloud.token;
-    if (cloud.refresh_token === undefined || cloud.refresh_token === "") return cloud.token;
-    return refreshAndPersist(config, cloud.refresh_token);
+    if (!isExpired(entry.token_expiry)) return entry.token;
+    if (entry.refresh_token === undefined || entry.refresh_token === "")
+      return entry.token;
+    return refreshAndPersist(config, entry, entry.refresh_token);
   };
 }
 
-async function refreshAndPersist(config: Config, refreshToken: string): Promise<string | null> {
+async function refreshAndPersist(
+  config: Config,
+  entry: NamedBackendConfig,
+  refreshToken: string,
+): Promise<string | null> {
   let next: TokenSet;
   try {
     next = await refreshAccessToken(refreshToken);
   } catch {
     // Refresh failed (revoked/expired refresh token). Fall back to the current
     // token if any; the server will reject it and the user is prompted to log in.
-    return config.backend.cloud?.token ?? null;
+    return entry.token ?? null;
   }
-  const cloud = config.backend.cloud ?? {};
-  cloud.token = next.accessToken;
-  if (next.refreshToken !== undefined) cloud.refresh_token = next.refreshToken;
-  cloud.token_expiry = next.expiresAt;
-  config.backend.cloud = cloud;
+  entry.token = next.accessToken;
+  if (next.refreshToken !== undefined) entry.refresh_token = next.refreshToken;
+  entry.token_expiry = next.expiresAt;
   save(config);
   return next.accessToken;
 }
@@ -120,7 +143,8 @@ async function postToken(form: Record<string, string>): Promise<TokenSet> {
 
   const body = (await response.json().catch(() => ({}))) as Auth0TokenResponse;
   if (!response.ok || body.access_token === undefined) {
-    const detail = body.error_description ?? body.error ?? `HTTP ${response.status}`;
+    const detail =
+      body.error_description ?? body.error ?? `HTTP ${response.status}`;
     throw new CliExitError(`authentication failed: ${detail}`, ExitCode.Auth);
   }
 

package/src/client/client.test.ts

@@ -4,7 +4,13 @@ import type { Config } from "../config/index.js";
 import { createBackendClient } from "./client.js";
 
 function cloud(token?: string): Config {
-  return { backend: { type: "cloud", cloud: { endpoint: "api.stigmer.ai:443", token } } };
+  return {
+    backend: { type: "cloud" },
+    backends: {
+      cloud: { type: "cloud", endpoint: "api.stigmer.ai:443", token },
+    },
+    current_backend: "cloud",
+  };
 }
 
 afterEach(() => {
@@ -19,7 +25,9 @@ describe("createBackendClient — endpoint normalization", () => {
   });
 
   it("normalizes the local endpoint to a plaintext base URL", () => {
-    const client = createBackendClient({ config: { backend: { type: "local" } } });
+    const client = createBackendClient({
+      config: { backend: { type: "local" } },
+    });
     expect(client.stigmer.baseUrl).toBe("http://localhost:7234");
   });
 });

package/src/commands/apikey/index.ts

@@ -6,11 +6,22 @@
 import { createHash } from "node:crypto";
 import { create } from "@bufbuild/protobuf";
 import { timestampDate } from "@bufbuild/protobuf/wkt";
-import { type ApiKey, ApiKeySchema } from "@stigmer/protos/ai/stigmer/iam/apikey/v1/api_pb";
+import {
+  type ApiKey,
+  ApiKeySchema,
+} from "@stigmer/protos/ai/stigmer/iam/apikey/v1/api_pb";
 import { ApiKeyHashSchema } from "@stigmer/protos/ai/stigmer/iam/apikey/v1/io_pb";
 import type { Command } from "commander";
-import { ensureAuthenticated, resolveContextOrganization } from "../../config/index.js";
-import { type OutputFlags, type OutputFormat, renderProtoJson, renderProtoYaml } from "../../output/index.js";
+import {
+  ensureAuthenticated,
+  resolveContextOrganization,
+} from "../../config/index.js";
+import {
+  type OutputFlags,
+  type OutputFormat,
+  renderProtoJson,
+  renderProtoYaml,
+} from "../../output/index.js";
 import { addReadFlags, readFormat } from "../shared.js";
 import { parseExpiration } from "./duration.js";
 
@@ -23,7 +34,9 @@ interface ApiKeyCreateFlags extends OutputFlags {
 }
 
 export function registerApiKey(program: Command): void {
-  const apikey = program.command("apikey").description("manage API keys for Stigmer Cloud authentication");
+  const apikey = program
+    .command("apikey")
+    .description("manage API keys for Stigmer Cloud authentication");
 
   const create = apikey
     .command("create")
@@ -71,14 +84,23 @@ async function runCreate(options: ApiKeyCreateFlags): Promise<void> {
   process.stdout.write(renderCreatedBanner(created));
 }
 
-async function runFingerprint(rawKey: string, options: OutputFlags): Promise<void> {
-  const hash = createHash("sha256").update(rawKey).digest("hex");
+async function runFingerprint(
+  rawKey: string,
+  options: OutputFlags,
+): Promise<void> {
+  // Base64URL without padding — the server's storage encoding (the Java
+  // ApiKeyHasher and the TS keymaterial module agree). This was hex until
+  // O3, which meant the computed hash could never match a stored key_hash
+  // and the lookup below always answered NotFound (gate ruling Q7).
+  const hash = createHash("sha256").update(rawKey).digest("base64url");
 
   const { connectBackend } = await import("../../backend.js");
   const client = connectBackend();
   ensureAuthenticated(client.config);
 
-  const key = await client.stigmer.apiKey.getByKeyHash(create(ApiKeyHashSchema, { value: hash }));
+  const key = await client.stigmer.apiKey.getByKeyHash(
+    create(ApiKeyHashSchema, { value: hash }),
+  );
   renderApiKey(key, readFormat(options));
 }
 
@@ -101,7 +123,8 @@ function renderApiKey(key: ApiKey, format: OutputFormat): void {
   }
   const lines = [`API Key: ${key.metadata?.id ?? ""}`, ""];
   if (key.metadata?.name) lines.push(`  Name:        ${key.metadata.name}`);
-  if (key.spec?.fingerprint) lines.push(`  Fingerprint: ***${key.spec.fingerprint}`);
+  if (key.spec?.fingerprint)
+    lines.push(`  Fingerprint: ***${key.spec.fingerprint}`);
   lines.push(`  Expires:     ${formatExpiry(key)}`);
   process.stdout.write(`${lines.join("\n")}\n`);
 }
@@ -121,13 +144,21 @@ function renderCreatedBanner(key: ApiKey): string {
     `  ID:          ${key.metadata?.id ?? ""}`,
   ];
   if (key.metadata?.name) lines.push(`  Name:        ${key.metadata.name}`);
-  if (key.spec?.fingerprint) lines.push(`  Fingerprint: ***${key.spec.fingerprint}`);
-  lines.push(`  Expires:     ${formatExpiry(key)}`, "", "Usage:", `  export STIGMER_API_KEY='${key.spec?.keyHash ?? ""}'`, "");
+  if (key.spec?.fingerprint)
+    lines.push(`  Fingerprint: ***${key.spec.fingerprint}`);
+  lines.push(
+    `  Expires:     ${formatExpiry(key)}`,
+    "",
+    "Usage:",
+    `  export STIGMER_API_KEY='${key.spec?.keyHash ?? ""}'`,
+    "",
+  );
   return `${lines.join("\n")}\n`;
 }
 
 function formatExpiry(key: ApiKey): string {
   if (key.spec?.neverExpires) return "Never";
-  if (key.spec?.expiresAt !== undefined) return timestampDate(key.spec.expiresAt).toISOString();
+  if (key.spec?.expiresAt !== undefined)
+    return timestampDate(key.spec.expiresAt).toISOString();
   return "Never";
 }